The growth of the digital landscape has brought with it a multitude of security threats. The OWASP Top 10 Application Risks is a comprehensive list of the most critical security risks facing modern web applications. The OWASP Top 10 risks have been updated regularly to reflect the latest threats in the cybersecurity landscape, and the latest version was released in the year 2021.

it is crucial for developers to stay informed about the latest security risks and take the necessary precautions to ensure the security of their applications. This includes regular security testing, using secure development practices, and keeping components up-to-date. By taking the necessary steps to secure their applications, developers can help to minimize the risk of security breaches and protect sensitive information.

Here is a breakdown of OWASP’s list in brief detail:

You can find out more information about the list and the methodology on OWASP Top 10:2021

• A01:2021-Broken Access Control moves up from the fifth position to the category with the most serious web application security risk; the contributed data indicates that on average, 3.81% of applications tested had one or more Common Weakness Enumerations (CWEs) with more than 318k occurrences of CWEs in this risk category. The 34 CWEs mapped to Broken Access Control had more occurrences in applications than any other category.
• A02:2021-Cryptographic Failures shifts up one position to #2, previously known as A3:2017-Sensitive Data Exposure, which was broad symptom rather than a root cause. The renewed name focuses on failures related to cryptography as it has been implicitly before. This category often leads to sensitive data exposure or system compromise.
• A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection with a max incidence rate of 19%, an average incidence rate of 3.37%, and the 33 CWEs mapped into this category have the second most occurrences in applications with 274k occurrences. Cross-site Scripting is now part of this category in this edition.
• A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, we need more threat modeling, secure design patterns and principles, and reference architectures. An insecure design cannot be fixed by a perfect implementation as by definition, needed security controls were never created to defend against specific attacks.
• A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration, with an average incidence rate of 4.5%, and over 208k occurrences of CWEs mapped to this risk category. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for A4:2017-XML External Entities (XXE) is now part of this risk category.
• A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
• A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.
• A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. A8:2017-Insecure Deserialization is now a part of this larger category.
• A09:2021-Security Logging and Monitoring Failures was previously A10:2017-Insufficient Logging & Monitoring and is added from the Top 10 community survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
• A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.

What was the methodology for curating this list?

First, we need to understand what Common Weakness Enumeration (CWE) is:

Common Weakness Enumeration (CWE)

is a list of software weaknesses that can be exploited by attackers to compromise the security of a system. CWEs provide a common language and standard for describing and managing security vulnerabilities, enabling engineers to easily identify, understand, and prioritize threats.

The National Institute of Standards and Technology (NIST) publicly shares its National Vulnerability Database (NVD) which showcases a slice of common CWEs

OWASP shared the changes in the 2021 installment of their Top 10 AppSec risk categories following a practice of 30 CWEs with multiple organizations/software houses. At the time they asked the subjects to share additional information if needed, but they only stuck with the 30 CWEs list and refrained from sharing any additional data (maybe fearing that any additional data could be outlying or non-relevant, who knows?). The year that followed, OWASP did not set any standards for the CWEs and asked the subject to share their insights freely. This expanded the number of shared risks to approximately 400 CWEs! This took months to curate, but it gave the people at OWASP a much more comprehensive list to work with. The categorization became harder as some CWEs are of the “root-cause” type (like Cryptographic Failures), while others are “symptoms” like (Sensitive data exposure). So OWASP decided to focus primarily on root-cause CWE’s because it provides a more logical route for identification and remediation. However, the list does still mix both root cause and symptoms. There is an average of 19.6 CWEs per category in this installment, with the lower bounds at 1 CWE for A10:2021-Server-Side Request Forgery (SSRF) to 40 CWEs in A04:2021-Insecure Design. This updated category structure offers additional training benefits as companies can focus on CWEs that make sense for a language/framework.

Is your code to complex to go over and remediate immediately? Consider installing a WAF solution, there is even a WAFaaS version available and can help you scan, identify and deploy remediations without breaking your budget or your backlog, you can read more about WAF on this blog.